Whether a company needs a data protection officer depends on which law applies, and the answers in Switzerland, the EU and Germany differ markedly. For Swiss SMEs with EU customers and for companies with sites in several countries, it pays to answer the questions separately. This article sets out the rules.
The GDPR
Under Article 37 GDPR, controllers and processors must designate a data protection officer if they are a public authority or body, if their core activities consist of regular and systematic monitoring of people on a large scale, or if their core activities consist of large-scale processing of special categories of personal data or data relating to criminal offences. For many ordinary SMEs none of these applies; for providers of tracking, rating or health services it often does.
Germany: the 20-person rule
Germany goes beyond the GDPR. Under § 38 of the German Federal Data Protection Act (BDSG), a data protection officer must also be designated if, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data. Regardless of headcount, the duty applies where processing is subject to a data protection impact assessment or where data is processed commercially for transfer or for market and opinion research. For companies with a German establishment, that is the relevant threshold.
Switzerland: voluntary, but with a benefit
The revised Swiss FADP imposes no obligation on private companies to appoint a data protection adviser (Art. 10 FADP). Voluntary appointment does bring a concrete benefit: a company that has appointed an adviser who works with professional independence and without instructions, has the necessary expertise, performs no incompatible tasks and whose contact details are published and reported to the FDPIC may, after consulting that adviser, forgo consulting the FDPIC on a data protection impact assessment with high residual risk. Federal bodies must appoint an adviser.
Tasks and position
Under the GDPR, the data protection officer advises the company, monitors compliance, advises on impact assessments, trains staff and is the contact point for the supervisory authority and data subjects. They must be involved early, may not receive instructions on how to perform their tasks, report to the highest management level and may not perform tasks leading to a conflict of interest — management or the head of IT are therefore usually ruled out. Contact details must be published and communicated to the supervisory authority. The role can be filled internally or externally. The glossary entry on the data protection officer gives an overview.
Not to be confused: representatives in the EU and Switzerland
Another duty is often confused with the DPO. Companies without an establishment in the EU that offer goods or services to people in the EU or monitor their behaviour must designate a representative in the EU under Article 27 GDPR, unless the processing is occasional and low-risk. Conversely, the Swiss FADP requires foreign controllers, under certain conditions, to designate a representative in Switzerland (Art. 14 FADP). For Swiss SaaS providers with EU customers, the EU representative is often the more relevant question than the DPO.
Internal or external?
An internal solution knows the company best but needs time, expertise and a person without conflicts of interest — rarely available in small companies. An external solution brings experience and independence but must learn the processes and needs a fixed internal contact. In practice many SMEs choose an external data protection adviser combined with an internal coordinating person.
The decision in five questions
1. Does the GDPR apply to your company, for example because of an EU establishment or offers to people in the EU?
2. If so: does one of the conditions of Article 37 GDPR apply?
3. Do you have an establishment in Germany and reach the 20-person threshold or one of the other conditions of § 38 BDSG?
4. As a company without an EU establishment, do you need a representative in the EU?
5. For Swiss activities: is a voluntary data protection adviser worthwhile, for example because of planned high-risk processing?
The differences between the FADP and the GDPR overall are described in GDPR vs revised FADP. We support implementation through our data protection consulting; the decision guide data protection in-house or external weighs the organisational options.